Add CORS auth and fix query